[Security Solution][RAC][Cases] Fix RAC "add to case" functionality from alerts table #116768

madirey · 2021-10-29T13:51:20Z

Summary

There are currently 2 issues when trying to attach an alert to a case. This is fallout from PRs merged before 8.0 FF.

When opening the context menu for selected alerts, the "Add to case" options are not enabled.
After fixing (1), another error is encountered when adding to a new case.

This PR addresses both and reenables the failing Cypress test.

With fix:

Checklist

Delete any items that are not applicable to this PR.

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Documentation was added for features that require explanation or tutorials
Unit or functional tests were updated or added to match the most common scenarios
Any UI touched in this PR is usable by keyboard only (learn more about keyboard accessibility)
Any UI touched in this PR does not create any new axe failures (run axe in browser: FF, Chrome)
If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the docker list
This renders correctly on smaller devices using a responsive layout. (You can test this in your browser)
This was checked for cross-browser compatibility

Risk Matrix

Delete this section if it is not applicable to this PR.

Before closing this PR, invite QA, stakeholders, and other developers to identify risks that should be tested prior to the change/feature release.

When forming the risk matrix, consider some of the following examples and how they may potentially impact the change:

Risk	Probability	Severity	Mitigation/Notes
Multiple Spaces—unexpected behavior in non-default Kibana Space.	Low	High	Integration tests will verify that all features are still supported in non-default Kibana Space and when user switches between spaces.
Multiple nodes—Elasticsearch polling might have race conditions when multiple Kibana nodes are polling for the same tasks.	High	Low	Tasks are idempotent, so executing them multiple times will not result in logical error, but will degrade performance. To test for this case we add plenty of unit tests around this logic and document manual testing procedure.
Code should gracefully handle cases when feature X or plugin Y are disabled.	Medium	High	Unit tests will verify that any feature flag or plugin combination still results in our service operational.
See more potential risk examples

For maintainers

This was checked for breaking API changes and was labeled appropriately

elasticmachine · 2021-10-29T13:51:25Z

Pinging @elastic/apm-ui (Team:apm)

elasticmachine · 2021-10-29T15:09:32Z

Pinging @elastic/security-threat-hunting-cases (Feature:Cases)

elasticmachine · 2021-10-29T15:09:33Z

Pinging @elastic/security-solution (Team: SecuritySolution)

kqualters-elastic

desk tested locally, add to new and add to existing case workflows are working well, lgtm 👍

jonathan-buttner

Tested locally that attaching to case works.

Just a few comments.

x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.tsx

…case

madirey · 2021-11-03T18:48:48Z

@jonathan-buttner I believe I have addressed all of your feedback. Thanks so much!

kibanamachine · 2021-11-03T20:33:46Z

💛 Build succeeded, but was flaky

Test Failures

[job] [logs] Security Solution Tests / Pagination should be able to change items count per page with the dropdown
[job] [logs] Security Solution Tests / Pagination should be able to go to next / previous page
[job] [logs] Security Solution Tests / Pagination should have 25 events in the page by default
[job] [logs] Security Solution Tests / Pagination should select 25 items per page by default

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`cases`	337	342	+5
`securitySolution`	2754	2755	+1
total			+6

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
`cases`	432	434	+2

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`cases`	303.9KB	310.2KB	+6.4KB
`securitySolution`	4.5MB	4.5MB	-6.6KB
`timelines`	236.0KB	236.6KB	+620.0B
total			+396.0B

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`securitySolution`	246.6KB	253.2KB	+6.6KB

Unknown metric groups

API count

id	before	after	diff
`cases`	476	478	+2

History

💔 Build #3689 failed 521c152
💔 Build #2903 failed 13e04f5
💔 Build #2825 failed de5bf6d
💔 Build #2803 failed 82aee2d

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

…rom alerts table (elastic#116768) * Fix add to case functionality * Use appropriate owner when attaching an alert to a case * Use field name constants * Gotta reskip the test * Better error handling * Fix type errors * Fix tests

kibanamachine · 2021-11-03T20:36:29Z

💚 Backport successful

Status	Branch	Result
✅	8.0

This backport PR will be merged automatically after passing CI.

…rom alerts table (#116768) (#117426) * Fix add to case functionality * Use appropriate owner when attaching an alert to a case * Use field name constants * Gotta reskip the test * Better error handling * Fix type errors * Fix tests Co-authored-by: Madison Caldwell <[email protected]>

madirey requested review from a team as code owners October 29, 2021 13:51

madirey requested review from academo and joeypoon and removed request for a team October 29, 2021 13:51

botelastic bot added the Team:APM All issues that need APM UI Team support label Oct 29, 2021

madirey added 2 commits October 29, 2021 09:53

Fix add to case functionality

be3cfa7

Use appropriate owner when attaching an alert to a case

82aee2d

madirey force-pushed the fix-rac-add-to-case branch from 09e2737 to 82aee2d Compare October 29, 2021 13:54

madirey mentioned this pull request Oct 29, 2021

[RAC][Security Solution] Adds migration to new SecuritySolution rule types #112113

Merged

9 tasks

Use field name constants

de5bf6d

madirey changed the title ~~Fix rac add to case~~ [Security Solution][RAC][Cases] Fix RAC "add to case" functionality from alerts table Oct 29, 2021

madirey removed request for a team, academo and joeypoon October 29, 2021 15:08

madirey added Feature:Cases Cases feature Feature:RAC label obsolete Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v8.0.0 and removed Team:APM All issues that need APM UI Team support labels Oct 29, 2021

madirey requested review from XavierM, jonathan-buttner, michaelolo24, kqualters-elastic and marshallmain October 29, 2021 15:10

madirey requested a review from dplumlee October 29, 2021 15:10

brianseeders changed the base branch from main to master October 29, 2021 15:16

kqualters-elastic approved these changes Oct 29, 2021

View reviewed changes

jonathan-buttner reviewed Oct 29, 2021

View reviewed changes

madirey added auto-backport Deprecated - use backport:version if exact versions are needed v8.1.0 labels Oct 29, 2021

madirey added 5 commits October 29, 2021 13:51

Gotta reskip the test

0be29bc

Better error handling

13e04f5

Merge branch 'main' of github.com:elastic/kibana into fix-rac-add-to-…

a596ab3

…case

Fix type errors

521c152

Merge branch 'main' of github.com:elastic/kibana into fix-rac-add-to-…

4184850

…case

madirey added the release_note:skip Skip the PR/issue when compiling release notes label Nov 3, 2021

Fix tests

60b7c43

madirey enabled auto-merge (squash) November 3, 2021 18:49

madirey merged commit bd97d1f into elastic:main Nov 3, 2021

kibanamachine mentioned this pull request Nov 3, 2021

[8.0] [Security Solution][RAC][Cases] Fix RAC "add to case" functionality from alerts table (#116768) #117426

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security Solution][RAC][Cases] Fix RAC "add to case" functionality from alerts table #116768

[Security Solution][RAC][Cases] Fix RAC "add to case" functionality from alerts table #116768

madirey commented Oct 29, 2021 •

edited

Loading

elasticmachine commented Oct 29, 2021

elasticmachine commented Oct 29, 2021

elasticmachine commented Oct 29, 2021

kqualters-elastic left a comment

jonathan-buttner left a comment

madirey commented Nov 3, 2021

kibanamachine commented Nov 3, 2021

API count

kibanamachine commented Nov 3, 2021

[Security Solution][RAC][Cases] Fix RAC "add to case" functionality from alerts table #116768

[Security Solution][RAC][Cases] Fix RAC "add to case" functionality from alerts table #116768

Conversation

madirey commented Oct 29, 2021 • edited Loading

Summary

Checklist

Risk Matrix

For maintainers

elasticmachine commented Oct 29, 2021

elasticmachine commented Oct 29, 2021

elasticmachine commented Oct 29, 2021

kqualters-elastic left a comment

Choose a reason for hiding this comment

jonathan-buttner left a comment

Choose a reason for hiding this comment

madirey commented Nov 3, 2021

kibanamachine commented Nov 3, 2021

💛 Build succeeded, but was flaky

Test Failures

Metrics [docs]

Module Count

Public APIs missing comments

Async chunks

Page load bundle

API count

History

kibanamachine commented Nov 3, 2021

💚 Backport successful

madirey commented Oct 29, 2021 •

edited

Loading